ContaoCMS (fka TYPOlight) 2.11 CSRF (Delete Admin- Delete Article)

ContaoCMS (fka TYPOlight) 2.11 version (and lower) in affected by a CSRF vulnerability which allows to delete administrator/users, delete article, news, newsletter and so on.
I’ve created an Advisory describing this vulnerability and the methods to exploit it:
ContaoCMS Ivano Binetti’s Advisory

Other web sites have reported my security Advisory:



D-Link DSL-2640B "0day" Vulnerabilities

SecurityFocus ( has assigned me three BID (Bugtraq ID) related to “0day” Dlink and Cisco Linksys vulnerabilities regarding design flaws and exploitable using CSRF:

Following you can read more details about them:

DFLabs PTK <= 1.0.5 Multiple Vulnerabilities (Steal Authentication Credentials)

To view my Original Advisory:
DFLabs PTK 1.0.5 Multiple Vulnerabilities (Steal Authentication Credentials)

Other related publications:

D-Link DSL-2640B Authentication Bypass

This router allows an attacker to bypass authentication and to login with administrator (“admin”) credentials. In fact when the administrator is logged in and an internal attacker will connect to web management interface (default is he will be able to see the MAC Address of logged admin. Symply changing his MAC Address the attacker can bypass authentication and login as administrator.

Fore more details


ForkCMS 3.2.5 CSRF and XSS "0day" Vulnerabilities

Today I’ve discovered multiple vulnerability into Fork CMS 3.2.5. I think there are also  this vulnerabilities  in version 3.2.6.

Other pubblication related to these vulnerabilities: